Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
This rule detects potential DCSync replication abuse by monitoring Security Event ID 4662, specifically looking for access to 'domainDNS' or user objects with the GUID '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', which is associated with Directory Replication Service (DRS) permissions. It filters out machine accounts to reduce false positives.
Detects remote LSASS memory dumping patterns associated with the lsassy tool, leveraging comsvcs.dll to create memory dumps of the LSASS process. The rule identifies suspicious command lines involving comsvcs.dll ordinal-based exports (ordinal #+000024), tasklist enumeration for PID discovery, and subsequent dump file creation within \Windows\Temp\. It monitors remote execution methods often observed in Bumblebee and Akira campaigns, such as WMI or DCOM/MMC-based process spawning.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup of the Active Directory database (NTDS.dit) and registry hives to a local SMB loopback share. This behavior is a technique used by Akira ransomware actors to bypass file locking mechanisms and exfiltrate sensitive credential material.
Detects the remote execution of credential dumping activities via the lsassy tool. The rule identifies rundll32.exe being used to load comsvcs.dll for the purpose of creating a full MiniDump of the LSASS process memory. It specifically monitors for these actions occurring within common remote administrative execution contexts, such as SMB services, WMI, scheduled tasks, and DCOM, with output files staged in the Windows\Temp directory.
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
Detects the modification of the WDigest 'UseLogonCredential' registry key. Enabling this key forces the WDigest security provider to store plaintext credentials in memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz.
Detects DCSync attacks abusing the directory replication (DRSUAPI) interface by auditing Windows Security Event 4662. The rule monitors for access to directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) on the domainDNS object, specifically excluding machine accounts and built-in service accounts to reduce noise. This behavior is indicative of unauthorized credential harvesting from Active Directory.
This rule detects potential credential dumping activity against the Local Security Authority Subsystem Service (LSASS) on a host shortly after a successful VPN logon. It correlates Sysmon Event ID 1 (Process Creation) representing known dumping techniques (Mimikatz, Procdump, or comsvcs.dll) with Windows Security Event ID 4624 (Logon) from a VPN source within a 5-minute window.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Detects potential credential dumping activities and unauthorized access to sensitive system files. The rule monitors for three primary indicators: raw disk device access (often associated with volume shadow copy dumping), suspicious DiskShadow utility execution, and NTDS.dit extraction using ntdsutil. Known administrative and backup software processes are excluded to minimize noise.
Detects attempts by non-system user accounts to access the SAM or SECURITY registry hives. These hives contain sensitive credential material, and unauthorized access is a common indicator of credential dumping activities, often associated with tools like Mimikatz or scripts attempting to extract local account hashes.
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
Detects attempts by non-system user accounts to access the SAM or SECURITY registry hives. These hives contain sensitive credential material, and unauthorized access is a common indicator of credential dumping activities, often associated with tools like Mimikatz or scripts attempting to extract local account hashes.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.
Page 18 of 38